Windows 365 for Agents¶

Windows 365 for Agents is a Microsoft Cloud PC offering, purpose-built to host autonomous AI agents on dedicated, IT-managed Windows (and Linux) virtual desktops. It first launched in private preview at Ignite 2025 (November 18, 2025) and entered public preview (US only) on May 1, 2026, announced on the Windows IT Pro blog. The product is positioned as the runtime layer of Microsoft's agentic stack: where Microsoft 365 Copilot brings AI into apps and Microsoft Agent 365 (generally available as of the May 2026 announcement) acts as the control plane, Windows 365 for Agents is the trusted execution environment in which agents actually do work.

What it is¶

The core idea is that an AI agent interacting with a graphical user interface needs the same fundamental resources as a human user — compute, network, identity, policy controls — and should therefore run on the same managed platform that IT already uses for employees. Instead of agents executing on ad hoc infrastructure (local machines, shared VMs, unmanaged cloud environments), each agent is assigned its own dedicated Cloud PC with its own Microsoft Entra ID identity, governed through Agent 365 and managed through Microsoft Intune. The Microsoft framing is explicit: "every employee in an organization has an identity and works on a managed device, such as a Windows 365 Enterprise Cloud PC. Now, each AI agent also has its own identity, governed through Agent 365 and running on a managed Cloud PC provided by Windows 365 for Agents. It's the same trust model and same IT controls — now extended to AI." (Microsoft Tech Community)

The problem this solves is real and operational. Many enterprise applications — legacy line-of-business systems, multistep workflows, browser-bound tools — were never built with APIs. Agents that want to drive them must interact through clicks, typing, and navigation, the same way a person does. This category of computer-using agents (CUAs) has been a governance gap: without a managed environment, IT cannot enforce identity, conditional access, auditing, or data-residency rules on agent execution.

Architecture¶

Windows 365 for Agents reuses the existing Windows 365 architecture rather than building a parallel virtualization stack. Per the Windows Experience blog, the foundation is the "hosted on behalf of" (HOBO) model: single-instance Azure VMs running in Microsoft's own Azure subscription, managed through Intune, secured with Entra ID, and connected via reverse-connect transport. Four pillars carry over directly to agent workloads:

Pillar	Detail
Identity & security	Entra ID authentication including passwordless and phish-resistant MFA; Conditional Access policies; Entra join (cloud-native) or hybrid join to AD DS
Unified management	Cloud PCs enrolled in Microsoft Intune — same console, provisioning policies, app deployment, and security baselines used for physical devices
Provisioning	Service fabric automatically provisions, scales, and manages Cloud PCs globally on license assignment — no customer-side infrastructure management
Global connectivity	Reverse-connect: both client and Cloud PC make outbound connections to the Microsoft Cloud (no inbound ports); STUN/TURN for restrictive networks

Agents run inside a sandboxed Agent Workspace with distinct agent accounts and minimal privileges, so their actions are auditable and isolated from any primary user session (Petri). The Model Context Protocol (MCP) is used to standardise how agents discover and call tools — apps, services, connectors — inside the Cloud PC, reducing credential exposure and providing a registry model for tool access. Both Windows and Linux Cloud PC images are supported; the Researcher with Microsoft Copilot Studio computer use is described by Microsoft as the first Microsoft solution to use Cloud PCs running Linux, enabling automated website navigation in a headless-style image.

The Microsoft positioning lines up the ecosystem as follows: Microsoft 365 Copilot brings AI into apps; Microsoft IQ is the intelligence layer that provides shared context across people, work, and the business; Agent 365 is the governance and control plane; Windows 365 for Agents is the execution layer; all of this runs on Azure as the global cloud foundation.

Capabilities exposed to agent makers¶

At launch in preview, Microsoft was already testing the platform with a set of third-party agent builders — Manus AI, Fellou, Genspark, Simular, and TinyFish (Petri). Agent makers receive a "trusted platform with modular UI controls, enterprise-grade security and flexibility to run on Windows or Linux," meaning they can build and deploy agents that open apps, process data, and automate tasks on a Cloud PC. Specific operational capabilities highlighted by Microsoft and downstream reporting include:

Elastic resource pools to spin up Cloud PCs for high-throughput agent workloads and tear them down when idle, reducing cost
Human-in-the-loop safeguards so that sensitive actions surface to a human reviewer before execution
Geo-level data residency for regulated industries
Segmentation, observability, and revocation through the same Intune/Entra tooling IT already uses

Adjacent Ignite 2025 announcements that ship alongside this offering include Windows 365 AI-enabled Cloud PCs (Copilot+ PC-like experiences streamed from the cloud — improved Windows Search, Click to Do actions, deeper Microsoft 365 Copilot integration), Windows 365 Reserve (GA — temporary Cloud PCs for device-loss continuity), Windows 365 Cloud Apps (per-app rather than full Cloud PC access), a migration API from Azure Virtual Desktop / Azure VMs to Windows 365, external identities (B2B) support, and Windows Cloud I/O protection for keyboard input/output defence against keylogging and keystroke injection.

How it fits into the Microsoft AI ecosystem¶

In Maarten's wiki terms, Windows 365 for Agents sits underneath the agents themselves and alongside the agent control plane:

[Microsoft 365 Copilot / third-party agent UX]
            |
[Agent 365 — control plane: identity, policy, permissions]
            |
[Microsoft IQ — shared intelligence / context]
            |
[Windows 365 for Agents — managed Cloud PC runtime] -- Intune + Entra ID
            |
[Microsoft Azure — global cloud foundation]

This is the same trust model Microsoft uses for human Cloud PC users, with one important shift: the agent is the principal. It has its own identity, its own device, its own scope of permission, and its own audit trail. For Maarten's earlier notes on Azure Foundry hosted agents, Claude managed agents, and the broader agents-overview, Windows 365 for Agents is the managed runtime answer specifically for computer-use agents that need to drive Windows or Linux GUIs — complementary to API-only or MCP-only agent deployments.

Limitations¶

US-only public preview as of 1 May 2026. No date has been announced for broader regional availability or GA.
Preview status means SLAs, pricing structure, and license-bundle details are not finalised; pricing has not been published in the announcement materials reviewed.
Computer-use reliability depends on the underlying agent model: tool-calling reliability, screen reasoning, and recovery from unexpected dialogs are still active research areas industry-wide and are not specifically addressed by the Cloud PC platform itself.
Cost model is not yet public — running a dedicated Cloud PC per agent (versus pooled VMs or containers) implies a non-trivial unit cost; Microsoft references "elastic resource pools" as the mitigation but customer-visible pricing is not in the public-preview announcement.
Schedules are subject to change — Microsoft has stated previews and future availability windows (for example, Windows 365 Link expansions in early 2026) are indicative, not commitments.

Sources¶

Changelog¶

2026-05-18 — Page created from https://techcommunity.microsoft.com/blog/windows-itpro-blog/windows-365-for-agents-now-in-public-preview/4512289 (Type A, confidence 92). The exact provided URL did not respond at fetch time; content was reconstructed from the corroborating Microsoft Tech Community post (4513479), the Windows Experience blog architecture article (22 Jan 2026), and Petri's Ignite 2025 preview coverage. All three sources agree on the architecture, capabilities, and positioning described above.